Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
youlaitech/youlai-mall
master @ 9f62de8
30
Fixes
9
CVEs
HIGH
Peak severity
66.7%
Coverage
Highlights
Auth Bypass: 24 prior fixes. Scrutinize any change in this area.
youlai-gateway: most-fixed (6 issues). Treat as high-risk during review.
18 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Auth Bypass: The API gateway's URL matching logic repeatedly failed to correctly identify and restrict admin paths due to loose AntPathMatcher wildcard patterns and case-sensitivity mismatches, leading to total authorization bypasses on administrative endpoints.
Auth Bypass: Method-level authorization annotations (like @PreAuthorize) were silently ignored because Spring Method Security was not enabled, and unsafe spring-security configurations bypassed path protections (CVE-2023-34035).
Auth Bypass: The gateway allowed request forwarding without ensuring that token verification and signature validation occurred, resulting in unauthenticated access to backend microservice endpoints.